A short guide to software updates

It comes up on almost every project, usually later than it should. Everything we would tell a client about software updates in the time it takes to drink a coffee.

Security is a maintenance habit rather than a purchase, which is why it drifts. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

Why this earns attention

Most breaches exploit a fix that already existed. The teams that handle this well are rarely the ones with the biggest budgets. If it only works because one person remembers to do something, it does not work yet.

What good looks like

Schedule updates rather than reacting to incidents. There is a version of this that is over-engineered, and it is worth avoiding. Doing this properly once is usually cheaper than doing it approximately three times.

Warning signs

Staging first prevents the update becoming the outage. This is the sort of thing that compounds, quietly, in both directions. Write the reasoning down alongside the decision, because the reasoning is what changes first.

How to tell if yours is fine

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about software updates before you move on:

• Someone can say what the current setup is without going to look
• Most breaches exploit a fix that already existed — and you know whether that is true here
• There is a way to tell whether the last change to this helped

The point is not perfection, it is knowing which of these you have consciously chosen to skip.